User Groups and Rights - Revision history

NWE at 11:52, 7 May 2025

2025-05-07T11:52:51Z

NWE: /* See also */

2025-05-05T21:01:51Z

‎See also

NWE: /* See Also */

2025-05-05T20:55:14Z

‎See Also

NWE at 15:26, 5 May 2025

2025-05-05T15:26:40Z

NWE: Created page with "Rights can be assigned to users via User Groups. == Big Picture == Big Picture: User, Groups and Rights When a use..."

2025-05-05T15:25:26Z

Created page with "Rights can be assigned to users via User Groups. == Big Picture == Big Picture: User, Groups and Rights When a use..."

New page

Rights can be assigned to [[LOGIN|users]] via [[USERGROUP|User Groups]].
== Big Picture ==
[[File:Usergrouprights.jpg|border|Big Picture: User, Groups and Rights]]

When a user requests an object from the web service (via the mobile app), the correct rights are evaluated.
The rights for an object are defined by programmatic customizing, overriding a respective method "CustomGroupRights".
A user can be (reverse) related to multiple user groups, which can also inherit from other user groups {{Version/ServerSince|4.9.1}}.
More specific group rights override rights assignments to more general groups.
The possibility to assign a user to different groups (not necessarily inheriting from each other) can lead to multiple (at first glance, conflicting) rights for different groups the user is in.
However, the rights have a priority assigned to them, and the highest right is chosen in the end.
== Rights Customization ==
See [[HowTo:Configure_Users_and_User_Rights]].
== Rights Evaluation ==
As described in the Big Picture, there is a hierarchy to user groups, which is now also considered by the UBIK Content web service {{Version/ServerSince|4.9.1}}.
The evaluation process goes as follows:
# Get object's custom group rights
# If they are not defined, default to "Write"
# Get user's group hierarchy
# Find the most specific group rights for this individual case
# Find the highest available right (first is highest):
## RestrictiveNoRight
## RestrictiveRead
## Write
## Read
## NoRight
... where "RestrictiveNoRight" will be translated into "NoRight" and "RestrictiveRead" will be translated into "Read" ultimately - they are just used to have a way for active restriction instead of only extension (similar to the idea of blacklisting instead of whitelisting).
== Caching ==
There was a complete overhaul of the user group caching mechanism of the UBIK Content web service {{Version/ServerSince|4.9.1}}.
It automatically establishes and maintains a working memory structure of the assignments between users and groups as well as the group hierarchy for fast access.
If change detection is enabled for the webservice (via AppSettings.config: setting UBIK.Service.EnableChangeNotifications = 1), the cache is updated as fast as possible as soon as any relevant change is detected. Otherwise, the cache is updated wrt. a login when this hasn't happened for some time and group data is being fetched.
One of the changes from the overhaul is that updates are not just scheduled asynchronously, but every cache access must await pending updates if they are relevant, while still aiming for a very fast evaluation - carefully weighing performance against integrity.
== See Also ==
* [[HowTo:Configure_Users_and_User_Rights]]
* [[USERGROUP|User Groups]]
* [[LOGIN|Logins]]

[[Category:Publishing|User Groups and Rights]]
[[Category:Studio|User Groups and Rights]]
[[Category:Web service|User Groups and Rights]]
[[Category:Coding|User Groups and Rights]]

@@ Line 35: / Line 35: @@
 * [[LOGIN|Logins]]
 * [[Configuration_Files/AppSettings.config|UBIK Content web service configuration]]
 [[Category:Coding|User Groups and Rights]]

@@ Line 30: / Line 30: @@
 If change detection is enabled for the webservice (via AppSettings.config: setting UBIK.Service.EnableChangeNotifications = 1), the cache is updated as fast as possible as soon as any relevant change is detected. Otherwise, the cache is updated wrt. a login when this hasn't happened for some time and group data is being fetched.
 One of the changes from the overhaul is that updates are not just scheduled asynchronously, but every cache access must await pending updates if they are relevant, while still aiming for a very fast evaluation - carefully weighing performance against integrity.
-== See Also ==
+== See also ==
 * [[HowTo:Configure_Users_and_User_Rights]]
 * [[USERGROUP|User Groups]]

@@ Line 5: / Line 5: @@
 When a user requests an object from the web service (via the mobile app), the correct rights are evaluated.
 The rights for an object are defined by programmatic customizing, overriding a respective method "CustomGroupRights".
-A user can be (reverse) related to multiple user groups, which can also inherit from other user groups {{Version/ServerSince|4.9.1}}.
+A user can be (reverse) related to multiple user groups, which can also inherit from other user groups {{Version/ServerSince|4.9.0}}.
 More specific group rights override rights assignments to more general groups.
 The possibility to assign a user to different groups (not necessarily inheriting from each other) can lead to multiple (at first glance, conflicting) rights for different groups the user is in.
@@ Line 12: / Line 12: @@
 See [[HowTo:Configure_Users_and_User_Rights]].
 == Rights Evaluation ==
-As described in the Big Picture, there is a hierarchy to user groups, which is now also considered by the UBIK Content web service {{Version/ServerSince|4.9.1}}.
+As described in the Big Picture, there is a hierarchy to user groups, which is now also considered by the UBIK Content web service {{Version/ServerSince|4.9.0}}.
 The evaluation process goes as follows:
 # Get object's custom group rights
@@ Line 26: / Line 26: @@
 ... where "RestrictiveNoRight" will be translated into "NoRight" and "RestrictiveRead" will be translated into "Read" ultimately - they are just used to have a way for active restriction instead of only extension (similar to the idea of blacklisting instead of whitelisting).
 == Caching ==
-There was a complete overhaul of the user group caching mechanism of the UBIK Content web service {{Version/ServerSince|4.9.1}}.
+There was a complete overhaul of the user group caching mechanism of the UBIK Content web service {{Version/ServerSince|4.9.0}}.
 It automatically establishes and maintains a working memory structure of the assignments between users and groups as well as the group hierarchy for fast access.
 If change detection is enabled for the webservice (via AppSettings.config: setting UBIK.Service.EnableChangeNotifications = 1), the cache is updated as fast as possible as soon as any relevant change is detected. Otherwise, the cache is updated wrt. a login when this hasn't happened for some time and group data is being fetched.
@@ Line 35: / Line 35: @@
 * [[LOGIN|Logins]]
 [[Category:Publishing|User Groups and Rights]]
 [[Category:Studio|User Groups and Rights]]
 [[Category:Web service|User Groups and Rights]]